# CVEs published 2023-09-08

54 CVEs were published on September 8, 2023: 0 critical, 4 high. Days are UTC.

- [CVE-2023-4844](https://cve.now/CVE-2023-4844.md): SourceCodester Simple Membership System club\_edit\_query.php sql injection (CVSS 6.3, SourceCodester Simple Membership System)
- [CVE-2022-22402](https://cve.now/CVE-2022-22402.md): IBM Aspera Faspex cross-site scripting (CVSS 5.4, IBM Aspera Faspex)
- [CVE-2022-22401](https://cve.now/CVE-2022-22401.md): IBM Aspera Faspex information disclosure (CVSS 5.9, IBM Aspera Faspex)
- [CVE-2022-22409](https://cve.now/CVE-2022-22409.md): IBM Aspera Faspex information disclosure (CVSS 5.3, IBM Aspera Faspex)
- [CVE-2023-40306](https://cve.now/CVE-2023-40306.md): URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search) (CVSS 6.1, SAP SE SAP S/4HANA)
- [CVE-2023-30995](https://cve.now/CVE-2023-30995.md): IBM Aspera Faspex improper access control (CVSS 7.5, IBM Aspera Faspex)
- [CVE-2023-24965](https://cve.now/CVE-2023-24965.md): IBM Aspera Faspex improper access control (CVSS 5.8, IBM Aspera Faspex)
- [CVE-2022-22405](https://cve.now/CVE-2022-22405.md): IBM Aspera Faspex information disclosure (CVSS 5.9, IBM Aspera Faspex)
- [CVE-2022-33164](https://cve.now/CVE-2022-33164.md): IBM Security Directory Server path traversal (CVSS 8.7, IBM Security Directory Integrator)
- [CVE-2023-32332](https://cve.now/CVE-2023-32332.md): IBM Maximo Application Suite and IBM Maximo Asset Management HTML injection (CVSS 5.4, IBM Maximo Asset Management · IBM Maximo Application Suite)
- [CVE-2023-41318](https://cve.now/CVE-2023-41318.md): Unsafe media served inline on download endpoints in matrix-media-repo (CVSS 4.1, turt2live matrix-media-repo · github.com/turt2live/matrix-m…)
- [CVE-2023-38736](https://cve.now/CVE-2023-38736.md): IBM QRadar WinCollect Agent privilege escalation (CVSS 7.5, IBM QRadar WinCollect Agent)
- [CVE-2023-41338](https://cve.now/CVE-2023-41338.md): Vulnerability in Ctx.IsFromLocal() in gofiber (CVSS 5.3, gofiber fiber · github.com/gofiber/fiber/v2 +1)
- [CVE-2023-28010](https://cve.now/CVE-2023-28010.md): HCL Domino is susceptible to a sensitive information disclosure vulnerability (CVSS 4.0, HCL Software HCL Domino Server)
- [CVE-2023-4782](https://cve.now/CVE-2023-4782.md): Terraform Allows Arbitrary File Write During Init Operation (CVSS 6.3, HashiCorp Terraform · github.com/hashicorp/terraform)
- [CVE-2023-39322](https://cve.now/CVE-2023-39322.md): Memory exhaustion in QUIC connection handling in crypto/tls (no CVSS, Go standard library crypto/tls · stdlib)
- [CVE-2023-39321](https://cve.now/CVE-2023-39321.md): Panic when processing post-handshake message on QUIC connections in crypto/tls (no CVSS, Go standard library crypto/tls · stdlib)
- [CVE-2023-39319](https://cve.now/CVE-2023-39319.md): Improper handling of special tags within script contexts in html/template (no CVSS, Go standard library html/template · stdlib)
- [CVE-2023-39320](https://cve.now/CVE-2023-39320.md): Arbitrary code execution via go.mod toolchain directive in cmd/go (no CVSS, Go toolchain cmd/go · toolchain)
- [CVE-2023-39318](https://cve.now/CVE-2023-39318.md): Improper handling of HTML-like comments in script contexts in html/template (no CVSS, Go standard library html/template · stdlib)
- [CVE-2023-4843](https://cve.now/CVE-2023-4843.md): Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however (CVSS 4.3, Pegasystems Pega Platform)
- [CVE-2023-4807](https://cve.now/CVE-2023-4807.md): POLY1305 MAC implementation corrupts XMM registers on Windows (CVSS 7.8, OpenSSL)
- [CVE-2023-4777](https://cve.now/CVE-2023-4777.md): Incorrect Permission Assignment on Qualys Container Scanning Connector Plugin 1.6.2.6 and earlier (CVSS 3.1, Qualys Container Scanning Connector Jenkins Plugin)
- [CVE-2023-34041](https://cve.now/CVE-2023-34041.md): CVE-2023-34041-Abuse of HTTP Hop-by-Hop Headers in Cloud Foundry Gorouter (CVSS 5.3, Cloud Foundry Routing · Cloud Foundry CF Deployment)
- [CVE-2023-41775](https://cve.now/CVE-2023-41775.md): Improper access control vulnerability in 'direct' Desktop App for macOS ver 2.6.0 and earlier allows a local attacker to bypass access restr (no CVSS, L is B 'direct' Desktop App for macOS)
- [CVE-2023-32470](https://cve.now/CVE-2023-32470.md): Dell Digital Delivery versions prior to 5.0.82.0 contain an Insecure Operation on Windows Junction / Mount Point vulnerability. (CVSS 5.0, Dell Digital Delivery)
- [CVE-2014-5329](https://cve.now/CVE-2014-5329.md): GIGAPOD file servers (Appliance model and Software model) provide two web interfaces, 80/tcp and 443/tcp for user operation, and 8001/tcp fo (no CVSS, TripodWorks CO. GIGAPOD OFFICEHARD Appliance model · Tri… +1)
- [CVE-2022-27599](https://cve.now/CVE-2022-27599.md): QVR Pro Client (CVSS 6.7, QNAP Systems QVR Pro Client)
- [CVE-2021-27715](https://cve.now/CVE-2021-27715.md): An issue was discovered in MoFi Network MOFI4500-4GXeLTE-V2 3.5.6-xnet-5052 allows attackers to bypass the authentication and execute arbitr (no CVSS)
- [CVE-2021-33834](https://cve.now/CVE-2021-33834.md): An issue was discovered in iscflashx64.sys 3.9.3.0 in Insyde H2OFFT 6.20.00. (no CVSS)
- [CVE-2021-45811](https://cve.now/CVE-2021-45811.md): A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execu (no CVSS)
- [CVE-2023-36184](https://cve.now/CVE-2023-36184.md): CMysten Labs Sui blockchain v1.2.0 was discovered to contain a stack overflow via the component /spec/openrpc.json. (no CVSS)
- [CVE-2023-37367](https://cve.now/CVE-2023-37367.md): An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem (Exynos 9820, Exynos 980, Exynos 850, Exynos 108 (CVSS 5.3)
- [CVE-2023-37368](https://cve.now/CVE-2023-37368.md): An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem (Exynos Mobile Processor, Automotive Processor, (CVSS 5.9)
- [CVE-2023-37377](https://cve.now/CVE-2023-37377.md): An issue was discovered in Samsung Exynos Mobile Processor and Wearable Processor (Exynos 980, Exynos 850, Exynos 2100, and Exynos W920). (CVSS 2.0)
- [CVE-2023-37759](https://cve.now/CVE-2023-37759.md): Incorrect access control in the User Registration page of Crypto Currency Tracker (CCT) before v9.5 allows unauthenticated attackers to regi (no CVSS)
- [CVE-2023-39076](https://cve.now/CVE-2023-39076.md): Injecting random data into the USB memory area on a General Motors (GM) Chevrolet Equinox 2021 Software. (no CVSS)
- [CVE-2023-39584](https://cve.now/CVE-2023-39584.md): Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability. (no CVSS, hexo)
- [CVE-2023-39620](https://cve.now/CVE-2023-39620.md): An Issue in Buffalo America, Inc. (no CVSS)
- [CVE-2023-39676](https://cve.now/CVE-2023-39676.md): FieldPopupNewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callbac (no CVSS)
- [CVE-2023-39712](https://cve.now/CVE-2023-39712.md): Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arb (no CVSS)
- [CVE-2023-40271](https://cve.now/CVE-2023-40271.md): In Trusted Firmware-M through TF-Mv1.8.0, for platforms that integrate the CryptoCell accelerator, when the CryptoCell PSA Driver software I (no CVSS)
- [CVE-2023-40353](https://cve.now/CVE-2023-40353.md): An issue was discovered in Exynos Mobile Processor 980 and 2100. (CVSS 2.0)
- [CVE-2023-40924](https://cve.now/CVE-2023-40924.md): SolarView Compact \< 6.00 is vulnerable to Directory Traversal. (no CVSS)
- [CVE-2023-40953](https://cve.now/CVE-2023-40953.md): icms 7.0.16 is vulnerable to Cross Site Request Forgery (CSRF). (no CVSS)
- [CVE-2023-41564](https://cve.now/CVE-2023-41564.md): An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via upl (no CVSS, cockpit-hq/cockpit)
- [CVE-2023-41575](https://cve.now/CVE-2023-41575.md): Multiple stored cross-site scripting (XSS) vulnerabilities in /bbdms/sign-up.php of Blood Bank & Donor Management v2.2 allow attackers to ex (no CVSS)
- [CVE-2023-41578](https://cve.now/CVE-2023-41578.md): Jeecg boot up to v3.5.3 was discovered to contain an arbitrary file read vulnerability via the interface /testConnection. (no CVSS, org.jeecgframework.boot:jeecg-boot-parent)
- [CVE-2023-41594](https://cve.now/CVE-2023-41594.md): Dairy Farm Shop Management System Using PHP and MySQL v1.1 was discovered to contain multiple SQL injection vulnerabilities in the Login fun (no CVSS)
- [CVE-2023-41615](https://cve.now/CVE-2023-41615.md): Zoo Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities in the Admin sign-in page via the username and p (no CVSS)
- [CVE-2023-42268](https://cve.now/CVE-2023-42268.md): Jeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the component /jeecg-boot/jmreport/show. (no CVSS, org.jeecgframework.boot:jeecg-boot-parent)
- [CVE-2023-42276](https://cve.now/CVE-2023-42276.md): hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonArray. (no CVSS, cn.hutool:hutool-core · cn.hutool:hutool-json)
- [CVE-2023-42277](https://cve.now/CVE-2023-42277.md): hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonObject.putByPath. (no CVSS, cn.hutool:hutool-core · cn.hutool:hutool-json)
- [CVE-2023-42278](https://cve.now/CVE-2023-42278.md): hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse(). (no CVSS, cn.hutool:hutool-core · cn.hutool:hutool-json)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-09-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.